Hi John,
The rule that was being triggered by Modsecurity was #981257 (Detects MySQL comment -/space - obfuscated injections and backtick termination)
To try and get past this, I disabled #981257 and now get blocked by rule #981245....
Detects basic SQL authentication bypass attempts 2/3
Request:
GET /administrator/index.php?option=com_jmap&task=ajaxserver.display&format=json&data=%7B%22idtask%22%3A%22fetchSeoStats%22%2C%22template%22%3A%22json%22%2C%22param%22%3A%7B%7D%7D
Action Description:
Access denied with redirection to
http://www.african-angler.net/ using status 302 (phase 2).
Justification:
Pattern match "(?i
?:union\\s*?(?:all|distinct|[(!@]*?)?\\s*?[([]*?\\s*?select\\s+)|(?:\\w+\\s+like\\s+[\"'`])|(?:like\\s*?[\"'`]\\%)|(?:[\"'`]\\s*?like\\W*?[\"'`\\d])|(?:[\"'`]\\s*?(?:n?and|x?x?or|div|like|between|and|not |\\|\\||\\&\\&
\\s+[\\s\\w]+=\\s*?\\w+\\s*? ..." at ARGS:data.
(note that I have migrated the site to african-angler.net)
So I disabled #981245 to see where we go...
I got hit with rule 981246...
www.african-angler.net 58.111.155.22 CRITICAL 302
Request:
GET /administrator/index.php?option=com_jmap&task=ajaxserver.display&format=json&data=%7B%22idtask%22%3A%22fetchSeoStats%22%2C%22template%22%3A%22json%22%2C%22param%22%3A%7B%7D%7D
Action Description:
Access denied with redirection to
http://www.african-angler.net/ using status 302 (phase 2).
Justification:
Pattern match "(?i
?:in\\s*?\\(+\\s*?select)|(?
?:n?and|x?x?or|div|like|between|and|not |\\|\\||\\&\\&
\\s+[\\s\\w+]+(?:regexp\\s*?\\(|sounds\\s+like\\s*?[\"'`]|[=\\d]+x))|([\"'`]\\s*?\\d\\s*?(?:--|#))|(?:[\"'`][\\%&<>^=]+\\d\\s*?(=|x?or|div|like|between|and))|(?:[ ..." at ARGS:data.
[b]So I disabled #981246 to see where we go... SUCCESS!!!!! SEO Stats works.[/b]
However, I am frightened to leave these rules disabled so I reset them all
I hope this helps.
Regard|[=\\d]+x))|([\"'`]\\s*?\\d\\s*?(?:--|#))|(?:[\"'`][\\%&<>^=]+\\d\\s*?(=|x?or|div|like|between|and))|(?:[ ..." at ARGS:data.
[b]So I disabled #981246 to see where we go... SUCCESS!!!!! SEO Stats works.[/b]
However, I am frightened to leave these rules disabled so I reset t+\\d\\s*?(=|x?or|div|like|between|and))|(?:[ ..." at ARGS:data.
So I disabled #981246 to see where we go... SUCCESS!!!!! SEO Stats works.
However, I am frightened to leave these rules disabled so I reset them all
I hope this helps.
Regards
